Centmin Mod Nginx only uses OpenSSL 1.0.2+ or LibreSSL 2.4/2.5. Centmin Mod 123.09beta01 supports using OpenSSL 1.1.0+ branch but only if you set it yourself. So this security update for OpenSSL 1.1.0e due in next 24hrs or so doesn't apply to Centmin Mod users, unless you overrode the default OPENSSL_VERSION='1.1.0d' and set LIBRESSL_SWICTH='n' in your persistent config file at /etc/centminmod/custom_config.inc.

i.e. only applies if you have previously set in /etc/centminmod/custom_config.inc prior to nginx recompiles via centmin.sh menu option 4.

Code (Text):

OPENSSL_VERSION='1.1.0d'
LIBRESSL_SWICTH='n'

Updating if you're on OpenSSL 1.1.0d is easy as updating the overridden version in /etc/centminmod/custom_config.inc and then recompiling Nginx via centmin.sh menu option.

The OpenSSL project team would like to announce the forthcoming release of
OpenSSL version 1.1.0e

This release will be made available on 16th February 2017 between 1200-1600
UTC, and will include a fix for a security defect classified as severity "High".
This issue does not affect OpenSSL versions prior to 1.1.0.

LibreSSL is default as it compiles much faster than OpenSSL and less security bugs overall. OpenSSL 1.1.0 compiles faster than OpenSSL 1.0.2 though but isn't compatible with nginx lua-nginx-module module yet

LibreSSL is default as it compiles much faster than OpenSSL and less security bugs overall. OpenSSL 1.1.0 compiles faster than OpenSSL 1.0.2 though but isn't compatible with nginx lua-nginx-module module yet

Click to expand...

I just found your post with your benchmarks.
The diference in terms of speed is tremendous in favor of OpenSSL.

During a renegotiation handshake if the Encrypt-Then-Mac extension is
negotiated where it was not in the original handshake (or vice-versa) then this
can cause OpenSSL to crash (dependent on ciphersuite). Both clients and servers
are affected.

OpenSSL 1.1.0 users should upgrade to 1.1.0e

This issue does not affect OpenSSL version 1.0.2.

This issue was reported to OpenSSL on 31st January 2017 by Joe Orton (Red Hat).
The fix was developed by Matt Caswell of the OpenSSL development team.

Note
====

Support for version 1.0.1 ended on 31st December 2016. Support for versions
0.9.8 and 1.0.0 ended on 31st December 2015. Those versions are no longer
receiving security updates.